debian-cve-check: Improve error handling when dst.json download fails #148
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
teradat
changed the title
teradat
force-pushed
the
improve-error-handling-when-dst.json-download-fails
branch
from
37a36a4 to
9f27b5f
Compare
teradat
changed the title
If the Debian Security Tracker json (dst.json) download fails or file is
invalid, the CVE check cannot be performed.
In this case, output backtrace [1] because there is insufficient error checking.
So improve to error handling.
When cve-check cannot be performed, there are two ways of thinking depending on
the purpose of bitbake:
1. The purpose is build, want to continue to build
e.g. `bitbake core-image-minimal`
2. The purpose is cve-check, want to immediately terminate with an error
e.g. `bitbake bash -c cve_check`
Add "CVE_CHECK_ERROR_ON_FAILURE" variable to satisfy these wants.
- Set "0" (is default): skip the CVE check and continue with build of bitbake
By disabling "CVE_CHECK_DB_FILE" variable, CVE check will be skipped in Poky's
do_cve_check() function.
This is the same behavior as if the NVD database download failed in Poky, skip
the CVE check and continue with build.
- Set "1": bitbake return fatal error immediately
Immediately exit with bb.fatal().
In summary, the following changes in this commit:
- Add exception handling to load_json()
Delete file exist check as they are handled by exception handling.
- Add check timestamp of the dst.json file
(Even if the dst.json download fails,) A successfully downloaded dst.json file
may still exist, so if the timestamp within CVE_DB_UPDATE_INTERVAL (default
24 hours), it is considered a valid file.
- Add error handling logic for "CVE_CHECK_ERROR_ON_FAILURE" variable
Change the log output lebel to match behavior of this variable.
- Some code style fixes
Add spaces after comma.
[1]
```
File: '<path-to>/meta-debian/classes/debian-cve-check.bbclass', lineno: 33, function: debian_cve_check
0029: _pkg_file_name = os.path.basename(_pkg_uri)
0030: pkgname = _pkg_file_name.split(";")[0].split("_")[0]
0031: break
0032:
*** 0033: if pkgname not in dst_data.keys():
0034: bb.note("%s is not found in Debian Security Tracker." % pkgname)
0035: return
0036:
0037: deb_patched, deb_unpatched = deb_check_cves(d, dst_data[pkgname])
Exception: AttributeError: 'NoneType' object has no attribute 'keys'
```
Signed-off-by: Takahiro Terada <takahiro.terada@miraclelinux.com>
teradat
force-pushed
the
improve-error-handling-when-dst.json-download-fails
branch
from
9f27b5f to
b298520
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Purpose of pull request
If the Debian Security Tracker json (dst.json) download fails or file is invalid, the CVE check cannot be performed.
In this case, output backtrace [1] because there is insufficient error checking.
So improve to error handling.
[1]
Background
When cve-check cannot be performed, there are two ways of thinking depending on the purpose of bitbake:
e.g.
bitbake core-image-minimale.g.
bitbake bash -c cve_checkAdd "CVE_CHECK_ERROR_ON_FAILURE" variable to satisfy these wants.
By disabling "CVE_CHECK_DB_FILE" variable, CVE check will be skipped in Poky's do_cve_check() function.
This is the same behavior as if the NVD database download failed in Poky, skip the CVE check and continue with build.
Immediately exit with bb.fatal().
Details of improvements
The following changes in this commit:
Delete file exist check as they are handled by exception handling.
(Even if the dst.json download fails,) A successfully downloaded dst.json file may still exist, so if the timestamp within CVE_DB_UPDATE_INTERVAL (default 24 hours), it is considered a valid file.
Change the log output lebel to match behavior of this variable.
Add spaces after comma.
Test
How to test
local.conf setting
DEBIAN_SECRUTY_TRACKER_JSON_URLto empty so that dst.json download failsDEBIAN_SECRUTY_TRACKER_JSON_URL_appendexists, comment it out.Add the following to local.conf.
And, for purpose of test, modify
CVE_CHECK_ERROR_ON_FAILURE.Preparing for testing
Remove the dst.json file.
Build bash package and check log
Test result
For skip behavior
Displayed WARNING message and bitbake succeeds.
For fatal behavior
By bb.fatal(), displayed ERROR message and bitbake stops.